There are two ways to be ready for a hard question. You can prepare an answer once you know the question is coming, or you can work in such a way that the answer already exists before anyone thinks to ask. Almost every organization treats compliance as the first kind. It is a project: something you mount in the weeks before an audit, a scramble to gather and arrange the evidence for a question you have known was coming all along. The date is on the calendar. The dread is annual. The work is real, and it is almost entirely the work of assembly.
Consider what it would take for it to be the second kind instead.
Suppose the answer were already there
Suppose the record of how the work normally happened were, on its own, the proof that it happened correctly. Every change already carrying its own account of who made it and when. Every approval already captured at the moment it was given, fixed to the exact thing being approved rather than to a vague description of it written up later for the file. Not a second pass over the work to document it, but simply how the work got done the first time, as a matter of course.
If that were true, there would be nothing to prepare. The question of who changed this, when, and who approved it would not set off a search, because the answer would already be sitting there, formed at the same instant as the change itself. You would not assemble the story when the question came. The story would have been keeping itself the whole time you were busy doing the work.
That is a larger shift than it first sounds, because it moves the evidence from something you produce to something that simply exists. The proof is no longer an artifact you manufacture on demand. It is a standing fact about the work, already true before anyone goes looking.
A project and a property are different kinds of thing
This is the difference between a project and a property, and the two are not merely different in degree; they are different in kind. A project is something you do. It has a start, a deadline, and a team that quietly dreads it. It gets finished, and then it comes due again, and in between those points it is simply not happening. A property is not something you do at all. It is true of a thing, continuously, whether or not anyone is looking or asking.
Waterproof is a property. Ready-by-Friday is a project. A watch that is waterproof does not brace for rain; the rain is not an event for it. The organizations that suffer least under scrutiny are not the ones with the most practiced scramble. They are the ones for whom the scramble was never necessary in the first place, because being provable was a property of how the work happened rather than a project bolted on when the question loomed into view.
Notice that this is not a matter of trying harder at the assembly. A better scramble is still a scramble. The shift is not from a sloppy project to a diligent one; it is from a project to a property, from something you have to mount to something that is simply the case.
The audit stops being an event
Follow that through, and the most familiar fixture of the corporate calendar quietly changes shape. The audit stops being an event. It is no longer a season you brace for, a window in which normal work pauses so that the separate work of proving the work can begin. It becomes closer to checking a fact than to mounting a defense. The answer is simply legible, because it was never allowed to go missing, so producing it is a matter of looking rather than building.
An organization that has crossed this line does not experience the hard question as a threat, because the hard question no longer asks anything of it that it has not already done. There is no gap between when the work happened and when the account of it was made, and it was always in that gap that the risk actually lived. Close the gap and you have not won the argument; you have dissolved the conditions under which there was an argument to have.
Compliance as a byproduct
Which is the whole reframe, stated plainly. Compliance was never supposed to be a thing you achieve in a sprint and then let quietly decay until the next one forces another sprint. It can be a byproduct: the natural residue of doing the work in a way that leaves the truth standing plainly behind it, so that proof is not a separate act you perform but a shadow the work casts on its own as it gets done.
You do not prepare for the question, in that world, because the answer was keeping itself the entire time. That is what it means for compliance to be a property and not a project. Not a better defense. No defense at all, because there was never a moment when the truth of what you did was in any danger of being lost.